Hey folks, 

just updated s3dns to make even stealthier. 

See the changes:

TCP/53 support — S3DNS now listens on both UDP and TCP port 53. Clients that retry over TCP after a truncated UDP response are handled correctly, with the query forwarded upstream over TCP to retrieve the full answer.

Larger DNS buffer — UDP receive buffer increased from 512 to 4096 bytes. EDNS0 options from the client are passed through to the upstream resolver unchanged.

Response cache — TTL-based LRU cache for DNS responses shared across UDP and TCP paths. Reduces upstream load and latency during active recon sessions. Configurable via CACHE\_SIZE (default: 1000 entries, set to 0 to disable).

Rate limiting — Per-client-IP request rate limit to prevent abuse. Configurable via RATE\_LIMIT (default: 100 req/s, set to 0 to disable).

Subdomain takeover detection — When a domain matches a cloud storage pattern but returns NXDOMAIN, S3DNS flags it as a possible domain takeover. This indicates a dangling DNS record pointing to an unclaimed bucket that an attacker could register.

IPv6 IP-range checks — AAAA records are now also resolved and checked against known cloud storage IP ranges. AWS IPv6 S3 prefixes are loaded alongside IPv4 ranges.

CNAME depth limit — Recursive CNAME chain following is now capped (default: 10 hops) to prevent infinite loops on crafted or cyclic records. Configurable via the max\_cname\_depth parameter.

Huge update for s3dns! Detects possible subdomain takeovers now!